Add Python 3.10+ version constraints and GitHub workflow permissions - #316
Conversation
Add minimal permission blocks to GitHub Actions workflows flagged by code scanning, and replace a sample MongoDB Atlas connection string in the docs with a placeholder to silence secret scanning. https://claude.ai/code/session_01TpxJA1jStTbtLqB6FgNFm4
Pin nltk>=3.9.4 and pytest>=9.0.3 on Python >= 3.10 to pick up fixes for the critical nltk zip-slip, the nltk path traversal, the nltk wordnet_app XSS/remote-shutdown/recursion issues, and the pytest tmpdir CVE. Both fix versions dropped Python 3.9 support, so the constraint is guarded by a python_version marker to keep 3.9 builds resolvable. Pillow remains at the most recent version compatible with each Python (12.2.0 on >=3.10, 11.3.0 on 3.9); the outstanding Pillow PSD/FITS alerts only affect the 3.9 resolution and cannot be fixed without dropping 3.9 support. https://claude.ai/code/session_01TpxJA1jStTbtLqB6FgNFm4
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the documentation to use placeholders for MongoDB connection strings and bumps the package version to 1.10.0. It also updates dependency constraints for nltk and pytest in pyproject.toml to target Python 3.10 and above. Feedback was provided to include constraints for Python versions older than 3.10, as the current changes would leave those environments without necessary dependencies for benchmarks and testing.
| "SetSimilaritySearch>=0.1.7", | ||
| "pyfarmhash>=0.2.2", | ||
| "nltk>=3.4.5", | ||
| "nltk>=3.9.4; python_version >= '3.10'", |
There was a problem hiding this comment.
The current change restricts nltk to Python 3.10 and above. Since the project appears to support older Python versions (as indicated by the numpy markers in uv.lock), this will cause nltk to be missing from the environment on Python < 3.10. If nltk is still required for benchmarks on older versions, you should provide a version constraint for those as well.
| "nltk>=3.9.4; python_version >= '3.10'", | |
| "nltk>=3.4.5; python_version < '3.10'", | |
| "nltk>=3.9.4; python_version >= '3.10'", |
| "nose>=1.3.7", | ||
| "nose-exclude>=0.5.0", | ||
| "pytest", | ||
| "pytest>=9.0.3; python_version >= '3.10'", |
There was a problem hiding this comment.
Restricting pytest to Python 3.10+ will prevent the test suite from being installed and run on older Python versions. To maintain support for Python < 3.10, you should include a compatible version of pytest for those environments.
| "pytest>=9.0.3; python_version >= '3.10'", | |
| "pytest; python_version < '3.10'", | |
| "pytest>=9.0.3; python_version >= '3.10'", |
Addresses gemini-code-assist review: the python_version >= '3.10' marker on its own drops these packages from the resolution on Python 3.9 entirely. Add fallback entries so Python 3.9 users still get nltk>=3.4.5 (the previous minimum) and an unpinned pytest. https://claude.ai/code/session_01TpxJA1jStTbtLqB6FgNFm4
2 participants
What does this PR do?
python_version >= '3.10') tonltkandpytestdependencies inpyproject.tomlto ensure compatibility with newer versionspermissionsblocks to all GitHub Actions workflows following the principle of least privilege:contents: readfor build, checks, test, and database test workflowscontents: writefor documentation workflow (needed for publishing)Checklist
https://claude.ai/code/session_01TpxJA1jStTbtLqB6FgNFm4